Hi,

CVE-2026-73206 from PowerDNS Security Advisory 2026-12 does not appear
to be fixed for pdns-recursor in trixie:

https://security-tracker.debian.org/tracker/CVE-2026-73206

The vulnerability allows a denial of service via crafted DNS packets
that trigger excessive work during name decompression (pointer-to-pointer
chains). Upstream fixed it in 5.3.12 and 5.4.8; the 5.2.x branch that
trixie ships is EOL upstream.

Is a security upload for trixie planned? If so, do you have an estimated
timeline? We are running pdns-recursor on trixie in production and need
to know whether to wait for a DSA or handle this ourselves in the
meantime.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-73206
[1] https://github.com/PowerDNS/pdns/pull/18207
[2] https
://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2026-12.html

Please adjust the affected versions in the BTS as needed.